An input validation flaw in Samsung Open Source rlottie allows an attacker to specify an excessively large quantity in a Lottie animation file, leading to unbounded memory allocation. The defect falls under CWE‑1284 (Improper Validation of Specified Quantity in Input) and CWE‑770 (Allocation of Resources Without Limits or Throttling). The resulting denial of service can cause the host application to consume all available memory, crash, or become unresponsive.

Applications that incorporate Samsung Open Source rlottie to render Lottie animations are affected. This includes UI frameworks, media players, and any software that embeds the library. No specific version range is listed, so the entire codebase may be vulnerable until an upstream fix is released.

The CVSS score of 6.5 denotes moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating a lower but still meaningful exploitation risk. The attack vector is inferred to be remote if a malicious Lottie file can be supplied from an external source, or local if the attacker can influence input to rlottie. Successful exploitation would exhaust memory or trigger a crash, resulting in a denial of service. Applying resource limits or validating input values can mitigate this risk.